Uly.me

cloud engineer

create

AWS Rotate IAM Keys

Here’s a script that will rotate AWS IAM keys.

#!/bin/bash
# set files
user='johndoe'
newkey='/root/new-access-key.json'
oldkey='/root/old-access-key.json'
credentials='/root/.aws/credentials'
# get old credentials
aws iam list-access-keys --user-name $user > $oldkey
okey=$(jq .AccessKeyMetadata[0].AccessKeyId $oldkey | tr -d \")
# create new key
aws iam create-access-key --user-name $user > $newkey
# get new access keys and new secret
nkey=$(jq .AccessKey.AccessKeyId $newkey | tr -d \")
nsecret=$(jq .AccessKey.SecretAccessKey $newkey | tr -d \")
# backup old credentials
cp /root/.aws/credentials /root/.aws/credentials-backup
# store the new key
echo '[default]' > $credentials
echo 'aws_access_key_id = ' $nkey >> $credentials
echo 'aws_secret_access_key = '$nsecret >> $credentials
sleep 10
# delete old key
aws iam delete-access-key --user-name $user --access-key-id $okey
rm $newkey
rm $oldkey

The script performs the following:

  1. Retrieves the current key
  2. Creates a new key
  3. Backup the current credentials file
  4. Create a new credentials file
  5. Deletes the old key
  6. Deletes the temp files
  7. Done

GCP UEFI Compatible

When trying to boot from a disk created from snapshot and you’re getting an “UEFI feature is not available for this project” error, you’ll need to create a boot image with the –guest-os-features option set to “UEFI_COMPATIBLE.”

gcloud compute disks create new-server-disk-2 \
--project=project-name \
--source-snapshot=server-disk-2 \
--zone=us-central1-b \
--guest-os-features="UEFI_COMPATIBLE"

It’s about enabling guest operating system features on custom images. The guest operating system features let you configure networking, security, storage, and operating system options on custom images to be used on boot disks.

Create Swap Disk

To see which disk is available for swap disk use.

lsblk
blkid
df -Th

Format the disk.

fdisk /dev/xvda

Create a swap disk.

sudo mkswap -f /dev/xvda
sudo swapon -s /dev/xvda
# or
sudo swapon /dev/xvda

Check if swap disk is available.

lsblk
free -h 
cat /proc/swaps
cat /proc/meminfo
swapon -s
top
vmstat
vmstat 1 5

IAM List Access Keys

Here’s how to list all the access keys in AWS via Python.

import logging
import boto3
from botocore.exceptions import ClientError
 
# set aws profile
session = boto3.Session(profile_name="default")
 
# get list of users
 
iam = session.client('iam')
users = iam.list_users()
 
# display results
print("{0:<20} {1:<25} {2:<15} {3:<10}".format('UserName', 'AccessKey', 'Status', 'CreateDate'))
print("----------------------------------------------------------------------------------------")
 
for a in users['Users']:
    user = a['UserName']
    # get keys
    keys = iam.list_access_keys(UserName=user)
    for b in keys['AccessKeyMetadata']:
        username = b['UserName']
        accesskeyid = b['AccessKeyId']
        status = b['Status']
        createdate = str(b['CreateDate'])
        print("{0:<20} {1:<25} {2:<15} {3:<10}".format(username, accesskeyid, status, createdate))

AWS CLI IAM Keys

Here’s a few commands to create, delete and disable AWS user keys.

List user keys.

aws iam list-access-keys --user-name john.doe

Create access key. Results are printed on screen in JSON format.

aws iam create-access-key --user-name john.doe

Disable a key. The real key id is obfuscated.

aws iam update-access-key \
--access-key-id ******************** \
--status Inactive \
--user-name john.doe

Delete a key. They real key id is obfuscated.

aws iam delete-access-key \
--access-key-id ******************** \
--user-name john.doe

GCP Move Instance to Another Project

Here’s how to copy a disk from one project to another.

gcloud compute disks create lamp-server \
--source-snapshot https://www.googleapis.com/compute/v1/projects/project-id/global/snapshots/lamp-server \
--project next-project-id \
--zone us-central1-a

Once all the disks are copied. You can create a snapshot of the boot.

gcloud compute disks snapshot lamp-server

Create an instance from snapshot.

gcloud compute disks create "hostname-boot" \
--project "project-id" \
--zone "us-central1-a" \
--source-snapshot "snapshot-name" \
--type "pd-standard" \
--size "100"